Research & Development Roadmap 1

Outline A New Communication Framework Giving Bro Control over the Network Security Monitoring for Industrial Control Systems Parallelism on Concurrent Architectures 2

COMMUNICATION NG 3

Communication Today Primitives Sending events &synchronized Limitations Model doesn’t scale; no hierarchies Loose semantics: best effort service No integration with persistence Implementation lacks robustness Two separate protocol implementations 4

Initial Proposal Extend event propagation Routing Subscription groups Push/pull models Remove &synchronized (and the proxies...) Add global, persistent data structure Probably just key/value store Explicit API 5

Initial Proposal (cont’d.) Implementation “Data nodes” in charge of tables; nodes attach Receive updates and broadcast them back out Limit values to atomic data types Use existing libraries Implement as a library Trading “magic” for better semantics and control 6

GIVING BRO CONTROL OVER THE NETWORK 7

Objectives Bro controls what it sees Adapt the front-end load-balancing Bro controls what the network does Block, steer, shape 8

Targeting 100 Gb/s... 9 Source: ESNet

Science DMZs 10 Source: ESNet 100 G 10/10 0G

Science DMZ Switch Control APIAPI 100 Gb/s Cluster G Load-balancer 100G Load-balancer 10GE Bro Cluster APIAPI Control BorderRouterBorderRouter 100GE

Transparent Script Interface Packet Acquisition drop(entity) sample(entity) notify(entity, cond) Packet Control drop(entity) sample(entity) throttle(entity) redirect(entity, destination) 12

Transparent Script Interface (cont’d.) “Entity” could be very different things... Plugins implement what hardware supports 13

SECURITY MONITORING FOR ICS 14

Industrial Control Systems Critical resources, yet lacking in protection Often legacy hardware hard to protect Not built with security in mind Class IDS not a good fit Attacks rare / unknown Behavioral approaches don’t take context into account 15

Industrial Control Systems (cont’d.) Significant potential through incorporating semantics Understand protocols Bro-style Create visibility Develop models of what we should be seeing Anomaly detection could actually work here 16

First steps... Protocol support in 2.2 Modbus DNP3 Only basic script analysis so far 17

Research Thrusts (1) Measurement study: What do we see? Actors, workloads, cross-site characterization As we do that, extend Bro’s logging Environments Municipal water and gas plants Campus power-plant Building automation at a large research lab Looking for more... 18

Research Thrusts (2) Semantic models for monitoring Statistical profiling Summary statistics framework Power Grid State Model PLC Memory Maps 19

PLC Memory Maps 20 Categorize registers Constant, attribute, continuos Derive predictive models... and validate them

PARALLELISM ON CONCURRENT ARCHITECTURES 21

Concurrency Potential 22

Concurrent Analysis 23 Network Event Engine Protocol Decoding Policy Script Interpreter Analysis Logic Logs Events Packets Notification

Architecture 24 Event Engine NetworkNetwork Events Notification Script Threads Scripting Language Event Engine Threads Event Engine Threads Packet Analysis Detection Logic DispatcherDispatcher Packet Dispatcher (NIC)

Thread1Thread1Thread2Thread2Thread3Thread3Thread4Thread4……ThreadnThreadn Parallel Event Scheduling 25 Threaded Script Interpreter Queue http_request Conn A http_request Conn B conn_rejected Orig X conn_rejected Orig X conn_rejected Orig Y http_reply Conn B http_request Conn A http_reply Conn A

New Platform: Abstract Machine 26 First-class networking types built-in Containers with state management support Platform for building high-level, reusable functionality on Domain-specific concurrency model Well-defined, contained execution environment Domain- specific Data Types Robust/Secure Execution Concurrent Analysis High-level Standard Components State Management Timers can drive execution Real-time Performance Support for incremental processing Extensive optimization potential Scalability through parallelization Static type-system, and robust error handling Compilation to native code A High-Level Intermediary Language for Traffic Inspection

HILTI Toolchain 27 A High-Level Intermediary Language for Traffic Inspection

Research Questions How to identify state dependencies? Static program analysis to drive scheduling How to leverage hardware capabilities? E.g., network processors, hardware lookup modules 28

HILTI enables more BinPAC++ Demo

Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory Robin Sommer International Computer Science Institute, & Lawrence Berkeley National Laboratory 30